5.9

CVE-2021-29443: Padding Oracle Attack due to Observable Timing Discrepancy in jose

Modified
AliasesGHSA-58f5-hfqc-jgch
Published 16-04-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-29443 is a medium (CVSS 5.9) Observable Discrepancy vulnerability in panva jose. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 67.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.17%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 16-04-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. A possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). All major release versions have had a patch released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `^1.28.1 || ^2.0.5 || >=3.11.4`. Users should upgrade their v1.x dependency to ^1.28.1, their v2.x dependency to ^2.0.5, and their v3.x dependency to ^3.11.4. Thanks to Jason from Microsoft Vulnerability Research (MSVR) for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

1.17%

Chance of exploitation in the next 30 days

Percentile

67%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Npm1 product
  • jose≥ 1.0.0, < 1.28.1 | ≥ 2.0.0, < 2.0.5 | ≥ 3.0.0, < 3.11.4
Panva1 product
  • jose< 1.28.1 | ≥ 1.0.0, < 1.28.1 | ≥ 2.0.0, < 2.0.5 | ≥ 3.0.0, < 3.11.4

2 vendors · 2 products

References

3 links